General
- Target Install_Win11_Win10_10079_20_DMAROFF_04212026.exe
- Size 3.5MB
- Sample260530-arnh8set6k
- SHA256 4d7ba7be0eeeec1cdaa619978198258dd121acb17572faee34a784690bf08737
- MD5 93d3a51a83ea52a0da44442d0acbb052
- SHA1 d7d89a8442ec5bb78c2f51e7870dabfedc5f7eec
- SHA512 52cbec18fd4c1818c00c605ecb29f28e618d74ca41125e9699a82ad585d54dab3306269be147c3de8c13443488be3595915e7f7ea98dcbdc258f9785816c5d5f
- SSDEEP 49152:t+qXr/1HuenGgr+Nn0v8IfDOutw9SjalWfddHUEwdCV5dgoyFyaDvldAur4lH4ZK:xHgM5hJ+EjMUZdgoyFyaDvldvutQ6
- TLSH T12C069E86A26C01A8C177C17C86535E17E77D7C68633186EB13D0A9692F23BE1673A31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_Win11_Win10_10079_20_DMAROFF_04212026.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_Win11_Win10_10079_20_DMAROFF_04212026.exe
Resource
win11-20260513-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target Install_Win11_Win10_10079_20_DMAROFF_04212026.exe
- Size 3.5MB
- SHA256 4d7ba7be0eeeec1cdaa619978198258dd121acb17572faee34a784690bf08737
- MD5 93d3a51a83ea52a0da44442d0acbb052
- SHA1 d7d89a8442ec5bb78c2f51e7870dabfedc5f7eec
- SHA512 52cbec18fd4c1818c00c605ecb29f28e618d74ca41125e9699a82ad585d54dab3306269be147c3de8c13443488be3595915e7f7ea98dcbdc258f9785816c5d5f
- SSDEEP 49152:t+qXr/1HuenGgr+Nn0v8IfDOutw9SjalWfddHUEwdCV5dgoyFyaDvldAur4lH4ZK:xHgM5hJ+EjMUZdgoyFyaDvldvutQ6
- TLSH T12C069E86A26C01A8C177C17C86535E17E77D7C68633186EB13D0A9692F23BE1673A31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1